/**
 * Copyright (c) 2011-2013, dafei 李飞 (myaniu AT gmail DOT com)
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package com.shiro.plugin;

import javax.servlet.http.HttpServletResponse;
import org.apache.shiro.authz.AuthorizationException;
import org.apache.shiro.authz.UnauthenticatedException;
import com.jfinal.aop.Interceptor;
import com.jfinal.aop.Invocation;
import com.ljph.jfinal.base.BaseController;

public class ShiroInterceptor implements Interceptor {
    
    @Override
	public void intercept(Invocation ai) {
    	
		AuthzHandler ah = ShiroKit.getAuthzHandler(ai.getActionKey());
		
		 BaseController controller = (BaseController)ai.getController();
		
		// 存在访问控制处理器。
		if (ah != null) {
			try {
				// 执行权限检查。
				ah.assertAuthorized();
			} catch (UnauthenticatedException lae) { 
				//这个没有登录的异常交给 LoginUIInterceptor拦截器去做
			} catch (AuthorizationException ae) {
				// RequiresRoles，RequiresPermissions授权异常
				// 如果没有权限访问对应的资源，返回HTTP状态码403，或者调转到为授权页面
			    
			    String ajaxRequest = controller.getRequest().getHeader("X-Requested-With"); 
			    if(ajaxRequest != null && ajaxRequest.length() > 0){ //ajax请求
		            
		            HttpServletResponse response = controller.getResponse();
	                response.setHeader("permission", "permissionDenied");
	                response.setStatus(401);
	                controller.commonFailJson("用户未登录");
		            
			    }else{
			        controller.renderError(403);
			    }
				   
				return;
			}
		}
		// 执行正常逻辑
		ai.invoke();
	}
}
